how can i rename the values in piechart

[navd]

I have piechart created and i want to rename the values that i have for all the pie slices .

[niketn]

@navd, if the field name for pie chart label is field, you can apply the following replace() command with regex match to retain only text after semicolon.

 <YourCurrentSearch>
| eval <yourFieldName>=replace(<yourFieldName>,"([^;]+);(.*)","\2")

Following is the run anywhere search for reference:

| makeresults
| eval field="compute;good count(6424)", value=6424
| append [| makeresults
| eval field="server;notify count(64)", value=64]
| fields - _time
| eval field=replace(field,"([^;]+);(.*)","\2")

[niketn]

@navd, is this different from your previous question https://answers.splunk.com/answers/614546/display-the-values-on-pie-slice-in-pie-chart.html ?

[navd]

yes ,now I wanted to rename

[niketn]

Ok, refer to answer below for this question. Also please accept the answer to your previous question if one of the suggested answers has worked out for you.

[493669]

You can try case statement:

<base search>|eval etc_state=case(etc_state=="compute;good" ,"good",etc_state=="server;notify","notify",1==1,"")

[kamlesh_vaghela]

HI @navd,

The labels are coming for events so you have to change before chart or stats command.

Can you please share your sample search & sample data (old label and new label)?

Thanks

[navd]

I have the statistics like this :

etc_state count

compute;good count(6424) 6424
server;notify count(64) 64

So,here I want to rename compute;good as Good and server;notify as notify